{"head":{"vars":["query_def_tech_label","top_def_tech_label","def_tactic_label","def_tactic_rel_label","def_tech_label","def_artifact_rel_label","def_artifact_label","off_artifact_label","off_artifact_rel_label","off_tech_label","off_tech_parent_label","off_tech_parent_is_toplevel","off_tactic_rel_label","off_tactic_label","def_tactic","def_tactic_rel","tactic_def_tech","def_tech","def_artifact_rel","def_artifact","off_artifact","off_artifact_rel","off_tech","off_tech_parent","off_tactic_rel","off_tactic"]},"results":{"bindings":[{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Group Policy Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1615"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"File and Directory Permissions Modification"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1222"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Group Policy Modification"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Group Policy Modification"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Access Removal"},"off_tech_parent_label":{"type":"literal","value":"Impact Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exchange Email Delegate Permissions"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Global User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add Office 365 Global Administrator Role"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"SID-History Injection"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"SID-History Injection"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Setuid and Setgid"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Setuid and Setgid"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Access Modeling"},"top_def_tech_label":{"type":"literal","value":"Operational Activity Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Access Modeling"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Group Policy Preferences"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Access Removal"},"off_tech_parent_label":{"type":"literal","value":"Impact Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exchange Email Delegate Permissions"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Global User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add Office 365 Global Administrator Role"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Account Locking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Active Certificate Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Certificate Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Active Certificate Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Certificate Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over C2 Channel"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Active Certificate Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Certificate Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Active Certificate Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Certificate Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Web Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Active Certificate Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Certificate Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Asymmetric Cryptography"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Active Logical Link Mapping"},"top_def_tech_label":{"type":"literal","value":"Network Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Logical Link Mapping"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Remote Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Active Logical Link Mapping"},"top_def_tech_label":{"type":"literal","value":"Network Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Logical Link Mapping"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Transport Agent"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Active Logical Link Mapping"},"top_def_tech_label":{"type":"literal","value":"Network Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Logical Link Mapping"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Web Server"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Active Physical Link Mapping"},"top_def_tech_label":{"type":"literal","value":"Network Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Physical Link Mapping"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Remote Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Active Physical Link Mapping"},"top_def_tech_label":{"type":"literal","value":"Network Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Physical Link Mapping"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Transport Agent"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Active Physical Link Mapping"},"top_def_tech_label":{"type":"literal","value":"Network Mapping"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Physical Link Mapping"},"def_artifact_rel_label":{"type":"literal","value":"maps"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Web Server"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#maps"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Rogue Domain Controller"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DCSync"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Credential Stuffing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Administrative Network Activity Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Email Forwarding Rule"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Disable Windows Event Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Process Environment Variable"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Email Rule"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Email Rule"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Stack Frame Canary Validation"},"def_artifact_rel_label":{"type":"literal","value":"validates"},"def_artifact_label":{"type":"literal","value":"Stack Frame"},"off_artifact_label":{"type":"literal","value":"Stack Frame"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation for Defense Evasion"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#validates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation for Defense Evasion"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation for Defense Evasion"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1211"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Reflective Code Loading"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1620"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Reflective Code Loading"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1620"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Stack Frame Canary Validation"},"def_artifact_rel_label":{"type":"literal","value":"validates"},"def_artifact_label":{"type":"literal","value":"Stack Frame"},"off_artifact_label":{"type":"literal","value":"Stack Frame"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#validates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Stack Frame Canary Validation"},"def_artifact_rel_label":{"type":"literal","value":"validates"},"def_artifact_label":{"type":"literal","value":"Stack Frame"},"off_artifact_label":{"type":"literal","value":"Stack Frame"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation for Credential Access"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#validates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation for Credential Access"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation for Credential Access"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Stack Frame Canary Validation"},"def_artifact_rel_label":{"type":"literal","value":"validates"},"def_artifact_label":{"type":"literal","value":"Stack Frame"},"off_artifact_label":{"type":"literal","value":"Stack Frame"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exploitation for Client Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#validates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exploitation for Client Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exploitation for Client Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1203"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Stack Frame Canary Validation"},"def_artifact_rel_label":{"type":"literal","value":"validates"},"def_artifact_label":{"type":"literal","value":"Stack Frame"},"off_artifact_label":{"type":"literal","value":"Stack Frame"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Exploitation for Privilege Escalation"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#validates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exploitation for Privilege Escalation"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exploitation for Privilege Escalation"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1068"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Drive-by Compromise"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Drive-by Compromise"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exploit Public-Facing Application"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exploit Public-Facing Application"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Process Hollowing"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Process Hollowing"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Process Hollowing"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Process Hollowing"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Credential API Hooking"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Credential API Hooking"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Credential API Hooking"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Code Segment"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Credential API Hooking"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Email Forwarding Rule"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Mavinject"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Mavinject"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Process Segment Execution Prevention"},"def_artifact_rel_label":{"type":"literal","value":"neutralizes"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Mavinject"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Segment Address Offset Randomization"},"def_artifact_rel_label":{"type":"literal","value":"obfuscates"},"def_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_label":{"type":"literal","value":"Process Segment"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Mavinject"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Disable Windows Event Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Process Environment Variable"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Email Rule"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Application Hardening"},"top_def_tech_label":{"type":"literal","value":"Application Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Application Configuration Hardening"},"def_artifact_rel_label":{"type":"literal","value":"hardens"},"def_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_label":{"type":"literal","value":"Email Rule"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#hardens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Communication Through Removable Media"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Data from Removable Media"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Audio Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Audio Capture"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Video Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Video Capture"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Query Registry"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Cloud Configuration"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Cloud Service Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1526"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Cloud Configuration"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cloud Service Dashboard"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1538"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"System Location Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Group Policy Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1615"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Cloud Storage"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cloud Storage Object Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Kernel"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Kernel"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Windows Registry"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Modify Registry"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rogue Domain Controller"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"File and Directory Permissions Modification"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1222"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Group Policy Modification"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"installs"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#installs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"installs"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#installs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software Deployment Tool"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software Deployment Tool"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Replication Through Removable Media"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Spearphishing"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Security Token"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Two-Factor Authentication Interception"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SecurityToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1111"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Credential Management System"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Exploitation for Credential Access"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Credential Management System"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Exploitation for Credential Access"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Password Store"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordStore"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"installs"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#installs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"installs"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#installs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software Deployment Tool"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software Deployment Tool"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Browser Extension"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Browser Extensions"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Browser Extension"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Browser Extensions"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Container Image Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Container Image"},"off_artifact_label":{"type":"literal","value":"Container Image"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Implant Container Image"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImageAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1525"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Client Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Client Software Binary"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Client Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Client Software Binary"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Group Policy Modification"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Replication Through Removable Media"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_rel_label":{"type":"literal","value":"connects"},"off_tech_label":{"type":"literal","value":"Hardware Additions"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#connects"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1200"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Password Database"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Security Account Manager"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Password Database"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"LSA Secrets"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Startup Directory"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Startup Items"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Startup Directory"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Startup Items"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exfiltration over USB"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Physical Medium"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Keyboard Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keylogging"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Web Server Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Portal Capture"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Web Server Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Portal Capture"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Keyboard Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keylogging"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Web Server Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Portal Capture"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Web Server Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Portal Capture"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Node Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Remote Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Email Forwarding Rule"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Compiler"},"off_artifact_rel_label":{"type":"literal","value":"runs"},"off_tech_label":{"type":"literal","value":"MSBuild"},"off_tech_parent_label":{"type":"literal","value":"Trusted Developer Utilities Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#runs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Compiler"},"off_artifact_rel_label":{"type":"literal","value":"runs"},"off_tech_label":{"type":"literal","value":"MSBuild"},"off_tech_parent_label":{"type":"literal","value":"Trusted Developer Utilities Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#runs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"SID-History Injection"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"SID-History Injection"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Code Repository"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Code Repositories"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Code Repository"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Code Repositories"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Control Panel Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Control Panel Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Time Application"},"off_artifact_rel_label":{"type":"literal","value":"may-run"},"off_tech_label":{"type":"literal","value":"Time Based Evasion"},"off_tech_parent_label":{"type":"literal","value":"Virtualization/Sandbox Evasion"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Time Application"},"off_artifact_rel_label":{"type":"literal","value":"may-run"},"off_tech_label":{"type":"literal","value":"Time Based Evasion"},"off_tech_parent_label":{"type":"literal","value":"Virtualization/Sandbox Evasion"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"System Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"System Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"ROMMONkit"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"ROMMONkit"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"System Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"System Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"ROMMONkit"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"ROMMONkit"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Time Providers"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Port Monitors"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Authentication Package"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Security Support Provider"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Winlogon Helper DLL"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Service Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Service Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Time Providers"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Port Monitors"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Security Support Provider"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Authentication Package"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Winlogon Helper DLL"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Service Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Service Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Setuid and Setgid"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Elevated Execution with Prompt"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Setuid and Setgid"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Elevated Execution with Prompt"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials in Registry"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Cloud Instance Metadata"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cloud Instance Metadata  API"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Group Policy Preferences"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"MacOS Keychain"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MacOSKeychain"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"In-memory Password Store"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Securityd Memory"},"off_tech_parent_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"In-memory Password Store"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Credentials from Web Browsers"},"off_tech_parent_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Outlook Forms"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Office Test"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Application Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Outlook Rules"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Add-ins"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Office Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add-ins"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Office Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add-ins"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Add-ins"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Add-ins"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Application Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Outlook Home Page"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Software Dependencies and Development Tools"},"off_tech_parent_label":{"type":"literal","value":"Supply Chain Compromise"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Software Dependencies and Development Tools"},"off_tech_parent_label":{"type":"literal","value":"Supply Chain Compromise"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Software Supply Chain"},"off_tech_parent_label":{"type":"literal","value":"Supply Chain Compromise"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Software Supply Chain"},"off_tech_parent_label":{"type":"literal","value":"Supply Chain Compromise"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Hardware Supply Chain"},"off_tech_parent_label":{"type":"literal","value":"Supply Chain Compromise"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Stored Procedure"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"SQL Stored Procedures"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Stored Procedure"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"SQL Stored Procedures"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Node Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Transport Agent"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Node Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Web Server"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"IIS Components"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"IIS Components"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Firewall Configuration"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Security Software Discovery"},"off_tech_parent_label":{"type":"literal","value":"Software Discovery"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Security Software Discovery"},"off_tech_parent_label":{"type":"literal","value":"Software Discovery"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Windows Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Windows Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Change Default File Association"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Netsh Helper DLL"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Shim"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Shim"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Shim Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Image File Execution Options Injection"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Change Default File Association"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Netsh Helper DLL"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Shim"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Shim"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Shim Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Image File Execution Options Injection"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"SIP and Trust Provider Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Subvert Trust Controls"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1553.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1553"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Disable Windows Event Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration Component"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Disable Windows Event Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationComponent"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Windows Registry Key"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Process Environment Variable"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"disables"},"off_tech_label":{"type":"literal","value":"Safe Mode Boot"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Firewall Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Disable or Modify System Firewall"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Hidden Window"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Virtualization Software"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Virtualization Software"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Virtualization Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Virtualization Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Hidden File System"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"VBA Stomping"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Email Rule"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Email Rule"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services Registry Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services Registry Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services Registry Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"queries"},"off_tech_label":{"type":"literal","value":"System Language Discovery"},"off_tech_parent_label":{"type":"literal","value":"System Location Discovery"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#queries"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1614.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Kernel"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"installs"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#installs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software Deployment Tool"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Credential Management System"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Exploitation for Credential Access"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software Deployment Tool"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"installs"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#installs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Browser Extension"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Browser Extensions"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Container Image Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Container Image"},"off_artifact_label":{"type":"literal","value":"Container Image"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Implant Container Image"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImageAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1525"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Client Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Client Software Binary"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Web Server Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Portal Capture"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Web Server Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Portal Capture"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Compiler"},"off_artifact_rel_label":{"type":"literal","value":"runs"},"off_tech_label":{"type":"literal","value":"MSBuild"},"off_tech_parent_label":{"type":"literal","value":"Trusted Developer Utilities Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#runs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Time Application"},"off_artifact_rel_label":{"type":"literal","value":"may-run"},"off_tech_label":{"type":"literal","value":"Time Based Evasion"},"off_tech_parent_label":{"type":"literal","value":"Virtualization/Sandbox Evasion"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"System Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"ROMMONkit"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"System Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"ROMMONkit"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Service Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Service Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Office Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add-ins"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Add-ins"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Software Dependencies and Development Tools"},"off_tech_parent_label":{"type":"literal","value":"Supply Chain Compromise"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Software Supply Chain"},"off_tech_parent_label":{"type":"literal","value":"Supply Chain Compromise"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Stored Procedure"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"SQL Stored Procedures"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"IIS Components"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Shim"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Shim"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Virtualization Software"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Virtualization Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"NTDS"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cached Domain Credentials"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Forced Authentication"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Credential Stuffing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Pass The Hash"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Pass The Ticket"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Pass The Ticket"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_label":{"type":"literal","value":"Authentication"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Pass The Hash"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authorization Event Thresholding"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_label":{"type":"literal","value":"Authorization"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Access Removal"},"off_tech_parent_label":{"type":"literal","value":"Impact Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exchange Email Delegate Permissions"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Global User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add Office 365 Global Administrator Role"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Biometric Authentication"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Bootloader Authentication"},"top_def_tech_label":{"type":"literal","value":"Platform Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Bootloader Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"Boot Loader"},"off_artifact_label":{"type":"literal","value":"Boot Loader"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Bootkit"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BootloaderAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Bootloader Authentication"},"top_def_tech_label":{"type":"literal","value":"Platform Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Bootloader Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"Boot Loader"},"off_artifact_label":{"type":"literal","value":"Boot Loader"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Bootkit"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BootloaderAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Certificate Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Certificate Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Certificate Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Certificate Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over C2 Channel"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Certificate Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Certificate Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Certificate Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Certificate Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Web Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Certificate Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Certificate Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Asymmetric Cryptography"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Obfuscation"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Fallback Channels"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Non-Application Layer Protocol"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Service"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Multi-Stage Channels"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Ingress Tool Transfer"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Encoding"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Access Software"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Dynamic Resolution"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Non-Standard Port"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Protocol Tunneling"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Man in the Browser"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Other Network Medium"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Automated Exfiltration"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Scheduled Transfer"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Transfer Size Limits"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over C2 Channel"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Rogue Domain Controller"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Service Session Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet File Transfer Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Lateral Tool Transfer"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Session"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkSession"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Session"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkSession"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Drive-by Compromise"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploit Public-Facing Application"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Trusted Relationship"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DCSync"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Desktop Protocol"},"off_tech_parent_label":{"type":"literal","value":"Remote Services"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"SSH"},"off_tech_parent_label":{"type":"literal","value":"Remote Services"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet File Transfer Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"File Transfer Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Mail Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DNS"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Proxy"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Proxy"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Multi-hop Proxy"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Domain Fronting"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Credential Stuffing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"CMSTP"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"CMSTP"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"TFTP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"TFTP Boot"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"TFTP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"TFTP Boot"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Multicast Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"LLMNR/NBT-NS Poisoning and SMB Relay"},"off_tech_parent_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"DHCP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"DHCP Spoofing"},"off_tech_parent_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Multicast Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"LLMNR/NBT-NS Poisoning and SMB Relay"},"off_tech_parent_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"DHCP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"DHCP Spoofing"},"off_tech_parent_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"RPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Kerberoasting"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Symmetric Cryptography"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Asymmetric Cryptography"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Malicious Link Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Direct Network Flood"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Reflection Amplification"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Service Exhaustion Flood"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Transmitted Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Exfiltration to Code Repository"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Remote Terminal Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Exfiltration to Code Repository"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Client-server Payload Profiling"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration to Cloud Storage"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Cloud Configuration"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Cloud Service Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1526"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Cloud Configuration"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cloud Service Dashboard"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1538"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"System Location Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Group Policy Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1615"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"File and Directory Permissions Modification"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1222"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Group Policy Modification"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Group Policy Modification"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1484"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Startup Directory"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Startup Items"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Startup Directory"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Startup Items"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Email Forwarding Rule"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"SID-History Injection"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"SID-History Injection"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Control Panel Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Control Panel Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Time Providers"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Port Monitors"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Authentication Package"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Security Support Provider"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Winlogon Helper DLL"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Time Providers"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Port Monitors"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Security Support Provider"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Authentication Package"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Winlogon Helper DLL"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Setuid and Setgid"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Access Control Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Setuid and Setgid"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Cloud Instance Metadata"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cloud Instance Metadata  API"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Group Policy"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Group Policy Preferences"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Office Test"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Application Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Outlook Home Page"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Application Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Outlook Rules"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Firewall Configuration"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Security Software Discovery"},"off_tech_parent_label":{"type":"literal","value":"Software Discovery"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Security Software Discovery"},"off_tech_parent_label":{"type":"literal","value":"Software Discovery"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1518"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Change Default File Association"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Netsh Helper DLL"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Shim Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Change Default File Association"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Netsh Helper DLL"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Shim Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"SIP and Trust Provider Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Subvert Trust Controls"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1553.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1553"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Disable Windows Event Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration Component"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Disable Windows Event Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationComponent"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Windows Registry Key"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Process Environment Variable"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"disables"},"off_tech_label":{"type":"literal","value":"Safe Mode Boot"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Firewall Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Disable or Modify System Firewall"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Application Configuration"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Email Rule"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"Email Rule"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Email Hiding Rules"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services Registry Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services Registry Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Configuration Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Configuration Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Configuration Resource"},"off_artifact_label":{"type":"literal","value":"System Configuration Init Database Record"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services Registry Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Connected Honeynet"},"top_def_tech_label":{"type":"literal","value":"Decoy Environment"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Environment"},"def_artifact_rel_label":{"type":"literal","value":"manages"},"def_artifact_label":{"type":"literal","value":"Decoy Artifact"},"off_artifact_label":{"type":"literal","value":"Decoy Artifact"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Information Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyEnvironment"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#manages"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Rogue Domain Controller"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet File Transfer Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Lateral Tool Transfer"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Trusted Relationship"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DCSync"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Proxy"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Credential Stuffing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Multicast Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"LLMNR/NBT-NS Poisoning and SMB Relay"},"off_tech_parent_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Multicast Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"LLMNR/NBT-NS Poisoning and SMB Relay"},"off_tech_parent_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Connection Attempt Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Kernel"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"installs"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#installs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software Deployment Tool"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Credential Management System"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Exploitation for Credential Access"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1212"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"installs"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#installs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software Deployment Tool"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Browser Extension"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Browser Extensions"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1176"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Container Image Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Container Image"},"off_artifact_label":{"type":"literal","value":"Container Image"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Implant Container Image"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImageAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1525"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Client Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Client Software Binary"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1554"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Web Server Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Portal Capture"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Web Server Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Portal Capture"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Compiler"},"off_artifact_rel_label":{"type":"literal","value":"runs"},"off_tech_label":{"type":"literal","value":"MSBuild"},"off_tech_parent_label":{"type":"literal","value":"Trusted Developer Utilities Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#runs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Time Application"},"off_artifact_rel_label":{"type":"literal","value":"may-run"},"off_tech_label":{"type":"literal","value":"Time Based Evasion"},"off_tech_parent_label":{"type":"literal","value":"Virtualization/Sandbox Evasion"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-run"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1497"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"System Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"ROMMONkit"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"System Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Firmware"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Firmware"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"ROMMONkit"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Service Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"System Service Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Office Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add-ins"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Add-ins"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Software Dependencies and Development Tools"},"off_tech_parent_label":{"type":"literal","value":"Supply Chain Compromise"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Software Supply Chain"},"off_tech_parent_label":{"type":"literal","value":"Supply Chain Compromise"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Stored Procedure"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"SQL Stored Procedures"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Software"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"IIS Components"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Shim"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Shim"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Application Shimming"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Shim"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Virtualization Software"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Virtualization Software"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Executable Installer File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Container Image Analysis"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"NTDS"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cached Domain Credentials"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Compromise Scope Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Access Removal"},"off_tech_parent_label":{"type":"literal","value":"Impact Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"NTDS"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"NTDS"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cached Domain Credentials"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cached Domain Credentials"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exchange Email Delegate Permissions"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Global User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add Office 365 Global Administrator Role"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Account Locking"},"def_artifact_rel_label":{"type":"literal","value":"disables"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#disables"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Authentication Cache Invalidation"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Eviction"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Domain Trust Policy"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Directory Service"},"off_artifact_label":{"type":"literal","value":"Directory Service"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainTrustPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Create Account"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Access Removal"},"off_tech_parent_label":{"type":"literal","value":"Impact Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Access Removal"},"off_tech_parent_label":{"type":"literal","value":"Impact Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Access Removal"},"off_tech_parent_label":{"type":"literal","value":"Impact Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Access Removal"},"off_tech_parent_label":{"type":"literal","value":"Impact Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Account Access Removal"},"off_tech_parent_label":{"type":"literal","value":"Impact Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1531"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"NTDS"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"NTDS"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cached Domain Credentials"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cached Domain Credentials"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Default User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Default Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Local Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Cloud Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exchange Email Delegate Permissions"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exchange Email Delegate Permissions"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exchange Email Delegate Permissions"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exchange Email Delegate Permissions"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exchange Email Delegate Permissions"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Global User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add Office 365 Global Administrator Role"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Global User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add Office 365 Global Administrator Role"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Global User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add Office 365 Global Administrator Role"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Global User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add Office 365 Global Administrator Role"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Global User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add Office 365 Global Administrator Role"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"use-limits"},"def_artifact_label":{"type":"literal","value":"Password"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"Password"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"Password"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"use-limits"},"def_artifact_label":{"type":"literal","value":"Password"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"use-limits"},"def_artifact_label":{"type":"literal","value":"Password"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"Password"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Local User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Local Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Biometric Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Multi-factor Authentication"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"One-time Password"},"def_artifact_rel_label":{"type":"literal","value":"authenticates"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Strong Password Policy"},"def_artifact_rel_label":{"type":"literal","value":"strengthens"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Account Permissions"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"User Account"},"off_artifact_label":{"type":"literal","value":"Cloud User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Cloud Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Hardening"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"NTDS"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cached Domain Credentials"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Revoking"},"top_def_tech_label":{"type":"literal","value":"Credential Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Revoking"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"NTDS"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cached Domain Credentials"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Rotation"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Rotation"},"def_artifact_rel_label":{"type":"literal","value":"regenerates"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"NTDS"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cached Domain Credentials"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Credential Transmission Scoping"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"DNS Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"DNS Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Dynamic Resolution"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"DNS Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"DNS Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DNS"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"DNS Denylisting"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Forward Resolution Domain Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Dynamic Resolution"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ForwardResolutionDomainDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"DNS Denylisting"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"DNS Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"DNS Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Dynamic Resolution"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"DNS Denylisting"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Reverse Resolution IP Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Dynamic Resolution"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ReverseResolutionIPDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"DNS Denylisting"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Forward Resolution Domain Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DNS"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ForwardResolutionDomainDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"DNS Denylisting"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"DNS Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"DNS Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DNS"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"DNS Denylisting"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Reverse Resolution IP Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DNS"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ReverseResolutionIPDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"DNS Traffic Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"DNS Traffic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Dynamic Resolution"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"DNS Traffic Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"DNS Traffic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"may-contain"},"def_artifact_label":{"type":"literal","value":"DNS Lookup"},"off_artifact_label":{"type":"literal","value":"DNS Lookup"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Network Sniffing"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-contain"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1040"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"DNS Traffic Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"DNS Traffic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"may-contain"},"def_artifact_label":{"type":"literal","value":"DNS Lookup"},"off_artifact_label":{"type":"literal","value":"DNS Lookup"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Network Sniffing"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-contain"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1040"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"DNS Traffic Analysis"},"top_def_tech_label":{"type":"literal","value":"Network Traffic Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"DNS Traffic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DNS"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Query Registry"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Windows Registry"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Modify Registry"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1112"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rogue Domain Controller"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Spearphishing"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Password Store"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordStore"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Password Database"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Security Account Manager"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Password Database"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"LSA Secrets"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Code Repository"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Code Repositories"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"Code Repository"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Code Repositories"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"MMC"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Elevated Execution with Prompt"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Elevated Execution with Prompt"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials in Registry"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"MacOS Keychain"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MacOSKeychain"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"In-memory Password Store"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Securityd Memory"},"off_tech_parent_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"In-memory Password Store"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Credentials from Web Browsers"},"off_tech_parent_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Outlook Forms"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Add-ins"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Windows Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Windows Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Image File Execution Options Injection"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Image File Execution Options Injection"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Hidden Window"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Hidden File System"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"VBA Stomping"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Data Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Database"},"off_artifact_label":{"type":"literal","value":"System Configuration Database"},"off_artifact_rel_label":{"type":"literal","value":"queries"},"off_tech_label":{"type":"literal","value":"System Language Discovery"},"off_tech_parent_label":{"type":"literal","value":"System Location Discovery"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Database"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#queries"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1614.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1614"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Database Query String Analysis"},"top_def_tech_label":{"type":"literal","value":"Process Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Database Query String Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Database Query"},"off_artifact_label":{"type":"literal","value":"Database Query"},"off_artifact_rel_label":{"type":"literal","value":"injects"},"off_tech_label":{"type":"literal","value":"Exploit Public-Facing Application"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQueryStringAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQuery"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQuery"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#injects"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Environment"},"top_def_tech_label":{"type":"literal","value":"Decoy Environment"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Environment"},"def_artifact_rel_label":{"type":"literal","value":"manages"},"def_artifact_label":{"type":"literal","value":"Decoy Artifact"},"off_artifact_label":{"type":"literal","value":"Decoy Artifact"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Information Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyEnvironment"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#manages"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Data from Local System"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Automated Collection"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-execute"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"File and Directory Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over C2 Channel"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Deobfuscate/Decode Files or Information"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Spearphishing"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Windows Shortcut File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Forced Authentication"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Database File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Command and Scripting Interpreter Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Container Image"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Implant Container Image"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1525"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Filesystem"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Binary Padding"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"obfuscates"},"off_tech_label":{"type":"literal","value":"Software Packing"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Compile After Delivery"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Invalid Code Signature"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Match Legitimate Name or Location"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Space after Filename"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Object File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Portable Executable Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"VDSO Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Object File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Portable Executable Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"VDSO Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Log File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Clear Linux or Mac System Logs"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"File Deletion"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"deletes"},"off_tech_label":{"type":"literal","value":"File Deletion"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Web Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Local Data Staging"},"off_tech_parent_label":{"type":"literal","value":"Data Staged"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Compiler Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"MSBuild"},"off_tech_parent_label":{"type":"literal","value":"Trusted Developer Utilities Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Kernel Modules and Extensions"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Re-opened Applications"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Symbolic Link"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Plist Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Kernel Modules and Extensions"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Re-opened Applications"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Symbolic Link"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Plist Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Sudo and Sudo Caching"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Sudo and Sudo Caching"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials in Files"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Command History Log File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Bash History"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Database File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials from Web Browsers"},"off_tech_parent_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Utility"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Library"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Custom Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Custom Method"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Asymmetric Cryptography"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Outlook Forms"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Malicious File Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Web Script File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launch Agent"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launch Daemon"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launch Agent"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launch Daemon"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":".bash_profile and .bashrc"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":".bash_profile and .bashrc"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Hidden Users"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Hidden Window"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"VBA Stomping"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Stored Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Runtime Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Via Service"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy File"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network File Share Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Data from Network Shared Drive"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1039"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Taint Shared Content"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1080"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network File Share Resource"},"off_artifact_rel_label":{"type":"literal","value":"unmounts"},"off_tech_label":{"type":"literal","value":"Network Share Connection Removal"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#unmounts"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Remote Data Staging"},"off_tech_parent_label":{"type":"literal","value":"Data Staged"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Web File Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Confluence"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Web File Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Sharepoint"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Web File Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Confluence"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Web File Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Sharepoint"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"External Defacement"},"off_tech_parent_label":{"type":"literal","value":"Defacement"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1491.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1491"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Data from Local System"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network File Share Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Data from Network Shared Drive"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1039"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Automated Collection"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-execute"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"File and Directory Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over C2 Channel"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Deobfuscate/Decode Files or Information"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Taint Shared Content"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1080"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Spearphishing"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Windows Shortcut File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Forced Authentication"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Database File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Command and Scripting Interpreter Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Container Image"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Implant Container Image"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1525"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"NTDS"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cached Domain Credentials"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Filesystem"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Binary Padding"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"obfuscates"},"off_tech_label":{"type":"literal","value":"Software Packing"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Compile After Delivery"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Invalid Code Signature"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Match Legitimate Name or Location"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Space after Filename"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Object File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Portable Executable Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"VDSO Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Object File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Portable Executable Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"VDSO Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Log File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Clear Linux or Mac System Logs"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"File Deletion"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"deletes"},"off_tech_label":{"type":"literal","value":"File Deletion"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network File Share Resource"},"off_artifact_rel_label":{"type":"literal","value":"unmounts"},"off_tech_label":{"type":"literal","value":"Network Share Connection Removal"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#unmounts"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Web Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Local Data Staging"},"off_tech_parent_label":{"type":"literal","value":"Data Staged"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Remote Data Staging"},"off_tech_parent_label":{"type":"literal","value":"Data Staged"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Compiler Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"MSBuild"},"off_tech_parent_label":{"type":"literal","value":"Trusted Developer Utilities Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Web File Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Confluence"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Web File Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Sharepoint"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Web File Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Sharepoint"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Web File Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Confluence"},"off_tech_parent_label":{"type":"literal","value":"Data from Information Repositories"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1213"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Kernel Modules and Extensions"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Re-opened Applications"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Symbolic Link"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Plist Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Kernel Modules and Extensions"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Re-opened Applications"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Symbolic Link"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Plist Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Sudo and Sudo Caching"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Sudo and Sudo Caching"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials in Files"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Command History Log File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Bash History"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Database File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials from Web Browsers"},"off_tech_parent_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Utility"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Library"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Custom Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Custom Method"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Asymmetric Cryptography"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Outlook Forms"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Malicious File Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Network Resource"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_label":{"type":"literal","value":"Network Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"External Defacement"},"off_tech_parent_label":{"type":"literal","value":"Defacement"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1491.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1491"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Web Script File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launch Agent"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launch Daemon"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launch Agent"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launch Daemon"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":".bash_profile and .bashrc"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":".bash_profile and .bashrc"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Hidden Users"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Hidden Window"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"VBA Stomping"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Stored Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Runtime Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Via Service"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Object"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy Session Token"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy Session Token"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1528"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Steal Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1539"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keychain"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1142"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"NTDS"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cached Domain Credentials"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Encrypted Credential"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Guessing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Cracking"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Password"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Password"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Token Impersonation/Theft"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Create Process with Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"copies"},"off_tech_label":{"type":"literal","value":"Make and Impersonate Token"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#copies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Access Token"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Session Cookie"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Decoy User Credential"},"top_def_tech_label":{"type":"literal","value":"Decoy Object"},"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Decoy User Credential"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"Credential"},"off_artifact_label":{"type":"literal","value":"Kerberos Ticket Granting Ticket"},"off_artifact_rel_label":{"type":"literal","value":"forges"},"off_tech_label":{"type":"literal","value":"Golden Ticket"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Credential"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#forges"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Disk Encryption"},"top_def_tech_label":{"type":"literal","value":"Platform Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Disk Encryption"},"def_artifact_rel_label":{"type":"literal","value":"encrypts"},"def_artifact_label":{"type":"literal","value":"Storage"},"off_artifact_label":{"type":"literal","value":"Cloud Storage"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cloud Storage Object Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiskEncryption"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Storage"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Disk Encryption"},"top_def_tech_label":{"type":"literal","value":"Platform Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Disk Encryption"},"def_artifact_rel_label":{"type":"literal","value":"encrypts"},"def_artifact_label":{"type":"literal","value":"Storage"},"off_artifact_label":{"type":"literal","value":"Storage"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Hidden File System"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiskEncryption"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Storage"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Storage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Domain Accounts"},"off_tech_parent_label":{"type":"literal","value":"Valid Accounts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1078"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exchange Email Delegate Permissions"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_label":{"type":"literal","value":"Global User Account"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Add Office 365 Global Administrator Role"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Domain Account Monitoring"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_label":{"type":"literal","value":"Domain User Account"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Domain Account"},"off_tech_parent_label":{"type":"literal","value":"Create Account"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1136"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Domain Name Reputation Analysis"},"top_def_tech_label":{"type":"literal","value":"Identifier Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Identifier Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Identifier"},"off_artifact_label":{"type":"literal","value":"URL"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Drive-by Compromise"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#URL"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Domain Name Reputation Analysis"},"top_def_tech_label":{"type":"literal","value":"Identifier Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Identifier Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Identifier"},"off_artifact_label":{"type":"literal","value":"URL"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Malicious Link Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#URL"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Domain Name Reputation Analysis"},"top_def_tech_label":{"type":"literal","value":"Identifier Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Identifier Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Identifier"},"off_artifact_label":{"type":"literal","value":"URL"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#URL"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Domain Name Reputation Analysis"},"top_def_tech_label":{"type":"literal","value":"Identifier Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Identifier Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Identifier"},"off_artifact_label":{"type":"literal","value":"URL"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Via Service"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IdentifierAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Identifier"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#URL"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Domain Trust Policy"},"top_def_tech_label":{"type":"literal","value":"Credential Hardening"},"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Domain Trust Policy"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Directory Service"},"off_artifact_label":{"type":"literal","value":"Directory Service"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DomainTrustPolicy"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Data from Local System"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Automated Collection"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-execute"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-execute"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"File and Directory Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over C2 Channel"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Deobfuscate/Decode Files or Information"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Deobfuscate/Decode Files or Information"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Spearphishing"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Spearphishing"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Windows Shortcut File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Forced Authentication"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Database File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Command and Scripting Interpreter Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Command and Scripting Interpreter Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Container Image"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Implant Container Image"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1525"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Filesystem"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Binary Padding"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Binary Padding"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"obfuscates"},"off_tech_label":{"type":"literal","value":"Software Packing"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Compile After Delivery"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"obfuscates"},"off_tech_label":{"type":"literal","value":"Software Packing"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Compile After Delivery"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Invalid Code Signature"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Invalid Code Signature"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Match Legitimate Name or Location"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Space after Filename"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Object File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Portable Executable Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"VDSO Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Object File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Portable Executable Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"VDSO Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Log File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Clear Linux or Mac System Logs"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"File Deletion"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"deletes"},"off_tech_label":{"type":"literal","value":"File Deletion"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Web Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Local Data Staging"},"off_tech_parent_label":{"type":"literal","value":"Data Staged"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Compiler Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"MSBuild"},"off_tech_parent_label":{"type":"literal","value":"Trusted Developer Utilities Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Kernel Modules and Extensions"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Re-opened Applications"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Symbolic Link"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Plist Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Kernel Modules and Extensions"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Re-opened Applications"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Symbolic Link"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Plist Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Sudo and Sudo Caching"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Sudo and Sudo Caching"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials in Files"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Command History Log File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Bash History"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Database File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials from Web Browsers"},"off_tech_parent_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Utility"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Library"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Custom Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Custom Method"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Asymmetric Cryptography"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Outlook Forms"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Outlook Forms"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Malicious File Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Malicious File Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Web Script File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Web Script File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launch Agent"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launch Daemon"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launch Agent"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launch Daemon"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":".bash_profile and .bashrc"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":".bash_profile and .bashrc"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Hidden Users"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Hidden Window"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"VBA Stomping"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"VBA Stomping"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Stored Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Runtime Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Runtime Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Via Service"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Obfuscation"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Fallback Channels"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Non-Application Layer Protocol"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Service"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Multi-Stage Channels"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Ingress Tool Transfer"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Encoding"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Access Software"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Dynamic Resolution"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Non-Standard Port"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Protocol Tunneling"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Man in the Browser"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Other Network Medium"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Automated Exfiltration"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Scheduled Transfer"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Transfer Size Limits"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over C2 Channel"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Rogue Domain Controller"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Email Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Email"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Spearphishing"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Service Session Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet File Transfer Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Lateral Tool Transfer"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Session"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkSession"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Session"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Remote Services"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkSession"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1133"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Drive-by Compromise"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploit Public-Facing Application"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Inbound Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Inbound Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploit Public-Facing Application"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Trusted Relationship"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DCSync"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Desktop Protocol"},"off_tech_parent_label":{"type":"literal","value":"Remote Services"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"SSH"},"off_tech_parent_label":{"type":"literal","value":"Remote Services"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet File Transfer Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"File Transfer Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Mail Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DNS"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Proxy"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Proxy"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Multi-hop Proxy"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Domain Fronting"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Additional Azure Service Principal Credentials"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Credential Stuffing"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Email Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Email"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"CMSTP"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"CMSTP"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"TFTP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"TFTP Boot"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"TFTP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"TFTP Boot"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Multicast Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"LLMNR/NBT-NS Poisoning and SMB Relay"},"off_tech_parent_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"DHCP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"DHCP Spoofing"},"off_tech_parent_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Multicast Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"LLMNR/NBT-NS Poisoning and SMB Relay"},"off_tech_parent_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"DHCP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"DHCP Spoofing"},"off_tech_parent_label":{"type":"literal","value":"Man-in-the-Middle"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"RPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Kerberoasting"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Symmetric Cryptography"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Asymmetric Cryptography"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Malicious Link Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Direct Network Flood"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Reflection Amplification"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Inbound Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Inbound Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Direct Network Flood"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Inbound Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Inbound Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Reflection Amplification"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Inbound Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Inbound Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Service Exhaustion Flood"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Service Exhaustion Flood"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Transmitted Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Email Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Email"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Inbound Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Inbound Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Email Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Email"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Inbound Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Inbound Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundNetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Exfiltration to Code Repository"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Remote Terminal Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Exfiltration to Code Repository"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Filtering"},"top_def_tech_label":{"type":"literal","value":"Network Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Network Traffic Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration to Cloud Storage"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTrafficFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Data from Local System"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Automated Collection"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-execute"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"File and Directory Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over C2 Channel"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Deobfuscate/Decode Files or Information"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Email Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Email"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Spearphishing"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Spearphishing"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Windows Shortcut File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Forced Authentication"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Database File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Command and Scripting Interpreter Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Container Image"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Implant Container Image"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1525"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Filesystem"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Binary Padding"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"obfuscates"},"off_tech_label":{"type":"literal","value":"Software Packing"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Compile After Delivery"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Invalid Code Signature"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Match Legitimate Name or Location"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Space after Filename"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Object File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Portable Executable Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"VDSO Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Object File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Portable Executable Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"VDSO Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Log File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Clear Linux or Mac System Logs"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"deletes"},"off_tech_label":{"type":"literal","value":"File Deletion"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"File Deletion"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Web Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Local Data Staging"},"off_tech_parent_label":{"type":"literal","value":"Data Staged"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Email Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Email"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Email Removal"},"def_artifact_rel_label":{"type":"literal","value":"may-access"},"def_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Remote Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Compiler Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"MSBuild"},"off_tech_parent_label":{"type":"literal","value":"Trusted Developer Utilities Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Re-opened Applications"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Kernel Modules and Extensions"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Symbolic Link"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Plist Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Kernel Modules and Extensions"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Re-opened Applications"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Symbolic Link"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Plist Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Sudo and Sudo Caching"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Sudo and Sudo Caching"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials in Files"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Command History Log File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Bash History"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Database File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials from Web Browsers"},"off_tech_parent_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Utility"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Library"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Custom Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Custom Method"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Asymmetric Cryptography"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Outlook Forms"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Malicious File Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Email Removal"},"def_artifact_rel_label":{"type":"literal","value":"may-access"},"def_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Transport Agent"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Web Script File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launch Agent"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launch Daemon"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launch Agent"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launch Daemon"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":".bash_profile and .bashrc"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":".bash_profile and .bashrc"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Hidden Users"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Hidden Window"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"VBA Stomping"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Stored Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Runtime Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Email Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Email"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Email Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Email"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Via Service"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Email Removal"},"top_def_tech_label":{"type":"literal","value":"File Eviction"},"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Removal"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Data from Local System"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Automated Collection"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1119"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-execute"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-execute"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"File and Directory Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1083"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over C2 Channel"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rootkit"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Deobfuscate/Decode Files or Information"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Deobfuscate/Decode Files or Information"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Spearphishing"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Spearphishing"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1534"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovement"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Windows Shortcut File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Forced Authentication"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1187"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Database File"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Command and Scripting Interpreter Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Command and Scripting Interpreter Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Software Deployment Tools Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1072"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Container Image"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Implant Container Image"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1525"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Filesystem"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Password File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"/etc/passwd and /etc/shadow"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Binary Padding"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Binary Padding"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"obfuscates"},"off_tech_label":{"type":"literal","value":"Software Packing"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Compile After Delivery"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"obfuscates"},"off_tech_label":{"type":"literal","value":"Software Packing"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Compile After Delivery"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Invalid Code Signature"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Invalid Code Signature"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Match Legitimate Name or Location"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Space after Filename"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Exfiltration"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"off_tech_parent_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Object File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Portable Executable Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"VDSO Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Dynamic-link Library Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Object File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Portable Executable Injection"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Proc Memory"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"VDSO Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Log File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Clear Linux or Mac System Logs"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"File Deletion"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"deletes"},"off_tech_label":{"type":"literal","value":"File Deletion"},"off_tech_parent_label":{"type":"literal","value":"Indicator Removal on Host"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1070"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Web Protocols"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Local Data Staging"},"off_tech_parent_label":{"type":"literal","value":"Data Staged"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1074"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Compiler Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"MSBuild"},"off_tech_parent_label":{"type":"literal","value":"Trusted Developer Utilities Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1127"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Microsoft HTML Application"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Kernel Modules and Extensions"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Re-opened Applications"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Symbolic Link"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Plist Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Kernel Module"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Kernel Modules and Extensions"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"LSASS Driver"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Re-opened Applications"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Symbolic Link"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Application Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Plist Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Sudo and Sudo Caching"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Sudo and Sudo Caching"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials in Files"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Command History Log File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Bash History"},"off_tech_parent_label":{"type":"literal","value":"Unsecured Credentials"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1552"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Database File"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Credentials from Web Browsers"},"off_tech_parent_label":{"type":"literal","value":"Credentials from Password Stores"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1555"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Password Filter DLL"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Pluggable Authentication Modules"},"off_tech_parent_label":{"type":"literal","value":"Modify Authentication Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1556"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Utility"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Library"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Custom Archive File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Archive via Custom Method"},"off_tech_parent_label":{"type":"literal","value":"Archive Collected Data"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1560"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Certificate File"},"off_artifact_rel_label":{"type":"literal","value":"may-transfer"},"off_tech_label":{"type":"literal","value":"Asymmetric Cryptography"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Outlook Forms"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Outlook Forms"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Malicious File Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Malicious File Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Web Script File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Web Script File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launch Agent"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launch Daemon"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Systemd Service"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launch Agent"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launch Daemon"},"off_tech_parent_label":{"type":"literal","value":"Create or Modify System Process"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1543"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":".bash_profile and .bashrc"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":".bash_profile and .bashrc"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Emond"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"User Init Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Hidden Users"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Hidden Window"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Run Virtual Instance"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"VBA Stomping"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Office Application File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"VBA Stomping"},"off_tech_parent_label":{"type":"literal","value":"Hide Artifacts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1564"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Stored Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Runtime Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Runtime Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"File"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Via Service"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccess"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"DLL Side-Loading"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Dylib Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Operating System Configuration File"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LD_PRELOAD"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"top_def_tech_label":{"type":"literal","value":"File Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"off_artifact_label":{"type":"literal","value":"Shared Library File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"COR_PROFILER"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Endpoint Health Beacon"},"top_def_tech_label":{"type":"literal","value":"Platform Monitoring"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Endpoint Health Beacon"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Remote Email Collection"},"off_tech_parent_label":{"type":"literal","value":"Email Collection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Endpoint Health Beacon"},"top_def_tech_label":{"type":"literal","value":"Platform Monitoring"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Endpoint Health Beacon"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Mail Server"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Transport Agent"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Endpoint Health Beacon"},"top_def_tech_label":{"type":"literal","value":"Platform Monitoring"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Endpoint Health Beacon"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Network Node"},"off_artifact_label":{"type":"literal","value":"Web Server"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Service Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Application Window Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-execute"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Process Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Information Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Time Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Deobfuscate/Decode Files or Information"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Deobfuscate/Decode Files or Information"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Command and Scripting Interpreter Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Binary Padding"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"obfuscates"},"off_tech_label":{"type":"literal","value":"Software Packing"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Compile After Delivery"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Invalid Code Signature"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Asynchronous Procedure Call"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Process Doppelgänging"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Asynchronous Procedure Call"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Process Doppelgänging"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Parent PID Spoofing"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Parent PID Spoofing"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Compiled HTML File"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Control Panel Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"CMSTP"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Compiled HTML File"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Control Panel Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"CMSTP"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Malicious File Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"SQL Stored Procedures"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Web Script File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Runtime Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Service Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Application Window Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-execute"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Owner/User Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1033"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Process Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1057"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Information Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1082"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Time Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1124"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Deobfuscate/Decode Files or Information"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Deobfuscate/Decode Files or Information"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1140"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"interprets"},"off_tech_label":{"type":"literal","value":"XSL Script Processing"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#interprets"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1220"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Command and Scripting Interpreter Execution"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1059"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Scheduled Task/Job Execution"},"off_tech_parent_label":{"type":"literal","value":"Privilege Escalation Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Binary Padding"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"obfuscates"},"off_tech_label":{"type":"literal","value":"Software Packing"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Compile After Delivery"},"off_tech_parent_label":{"type":"literal","value":"Obfuscated Files or Information"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1027"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Invalid Code Signature"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Rename System Utilities"},"off_tech_parent_label":{"type":"literal","value":"Masquerading"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Windows)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Logon Script (Mac)"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Network Init Script File Resource"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Network Logon Script"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"System Init Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Rc.common"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Initialization Scripts"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1037"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Asynchronous Procedure Call"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Process Doppelgänging"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Thread Execution Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Asynchronous Procedure Call"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Process Doppelgänging"},"off_tech_parent_label":{"type":"literal","value":"Process Injection"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1055"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Parent PID Spoofing"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Parent PID Spoofing"},"off_tech_parent_label":{"type":"literal","value":"Access Token Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1134"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Compiled HTML File"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Control Panel Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"CMSTP"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Compiled HTML File"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Control Panel Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"CMSTP"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Mshta Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Rundll32 Execution"},"off_tech_parent_label":{"type":"literal","value":"Signed Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Registry Run Keys / Startup Folder"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Startup Script File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Shortcut Modification"},"off_tech_parent_label":{"type":"literal","value":"Boot or Logon Autostart Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1547"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Bypass User Access Control"},"off_tech_parent_label":{"type":"literal","value":"Abuse Elevation Control Mechanism"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1548"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-add"},"off_tech_label":{"type":"literal","value":"Office Template Macros"},"off_tech_parent_label":{"type":"literal","value":"Office Application Startup"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-add"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1137"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Malicious File Execution"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Execution"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"SQL Stored Procedures"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Web Script File"},"off_artifact_rel_label":{"type":"literal","value":"adds"},"off_tech_label":{"type":"literal","value":"Web Shell"},"off_tech_parent_label":{"type":"literal","value":"Server Software Component"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#adds"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1505"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Screensaver"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Trap"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"LC_LOAD_DYLIB Addition"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"AppCert DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"AppInit DLLs"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"PowerShell Profile Script"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"PowerShell Profile"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Binary"},"off_artifact_rel_label":{"type":"literal","value":"loads"},"off_tech_label":{"type":"literal","value":"Component Object Model Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#loads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"User Init Script"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Impair Command History Logging"},"off_tech_parent_label":{"type":"literal","value":"Impair Defenses"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1562"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Runtime Data Manipulation"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Impact"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasion"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Persistence"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by PATH Environment Variable"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Search Order Hijacking"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Executable Denylisting"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Path Interception by Unquoted Path"},"off_tech_parent_label":{"type":"literal","value":"Hijack Execution Flow"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"false"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalation"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"IO Port Restriction"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Communication Through Removable Media"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command And Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControl"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"IO Port Restriction"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Data from Removable Media"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"System Call"},"off_artifact_label":{"type":"literal","value":"Get Screen Capture"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Screen Capture"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GetScreenCapture"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1113"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"IO Port Restriction"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Input Device"},"off_artifact_label":{"type":"literal","value":"Audio Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Audio Capture"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"IO Port Restriction"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Input Device"},"off_artifact_label":{"type":"literal","value":"Video Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Video Capture"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Collection"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Service Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"System Call"},"off_artifact_label":{"type":"literal","value":"Get Running Processes"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Service Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware-based Process Isolation"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Service Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Mandatory Access Control"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Service Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Service Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"System Call"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Service Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"System Call"},"off_artifact_label":{"type":"literal","value":"Get Open Windows"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Application Window Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GetOpenWindows"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"System Call"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Application Window Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware-based Process Isolation"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Application Window Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Mandatory Access Control"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Application Window Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Application Window Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Application Window Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1010"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"System Call"},"off_artifact_label":{"type":"literal","value":"Get System Config Value"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"Query Registry"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemConfigValue"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1012"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-execute"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"blocks"},"def_artifact_label":{"type":"literal","value":"Executable File"},"off_artifact_label":{"type":"literal","value":"Executable Script"},"off_artifact_rel_label":{"type":"literal","value":"may-execute"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#blocks"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1016"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Discovery"}},{"query_def_tech_label":{"type":"literal","value":"Execution Isolation"},"top_def_tech_label":{"type":"literal","value":"Execution Isolation"},"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware-based Process Isolation"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"may-invoke"},"off_tech_label":{"type":"literal","value":"System Network Configuration Discovery"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"datatype":"http://www.w3.org/2001/XMLSchema#boolean","type":"literal","value":"true"},"off_tactic_rel_label":{"type